← Back
Privacy Policy
Last Updated: October 5, 2026
Effective Date: October 5, 2026
1. INTRODUCTION
This Privacy Policy explains how Yuliia Mykytiuk, a Ukrainian sole proprietor (fizychna osoba-pidpryiemets, FOP), processes personal data when you use the WhatToCook mobile application and the WhatToCook website, together the Service, as defined in our Terms of Use. You and user have the same meaning here as in our Terms of Use, described further in Section 2, Definitions.
We are the controller of your personal data. You can reach us at support@what-to-cook-app.com. Our full identification as publisher is in Section 1, Acceptance of Terms, of our Terms of Use.
This Privacy Policy applies to the Service and should be read together with our Terms of Use.
2. DEFINITIONS
Terms not defined here have the meaning given to them in our Terms of Use, including Service, Account, Pro, Pro Entitlement, Preferences, Content, User Content, AI Generated Content, Store, Stores, and Daily Fact.
Personal Data means any information relating to an identified or identifiable individual, as defined under applicable data protection law.
Allergy Data means the part of your Preferences relating to allergies, intolerances, and hard dietary exclusions.
Recognition Photo means a photo you submit through photo ingredient recognition, described in Section 9.2 of the Terms of Use, as distinct from a photo you attach to User Content.
On-Device Data means data stored only on your device. Server Data means data stored on our servers.
Processor means a provider that processes Personal Data on our instructions to operate the Service. Independent Controller means a provider that processes Personal Data under its own terms and for its own purposes, not on our instructions.
3. DATA WE COLLECT AND WHERE IT IS STORED
Account and identity. If you create an Account, we store your email address, your password in hashed form, or an authentication identifier from Google or Apple sign in where you choose it, and your display name, as Server Data.
Preferences, including Allergy Data. Your diet, cuisine, liked and disliked ingredients, household size, and Allergy Data are On-Device Data.
Fresh ingredients and cook history. The ingredients you enter as available today and your recent cook history are On-Device Data.
Favorites and ratings. If you are not signed in, your Favorites and ratings are On-Device Data only. If you are signed in and you favorite a recipe, whether a catalog recipe or an AI Generated recipe, we store a copy of that recipe as Server Data so that it syncs across your devices.
User Content. Custom meals you save under My Meals, including any photo you attach to them, are On-Device Data.
Recognition Photo. If you use photo ingredient recognition, your photo is sent through our servers to Google Gemini to identify ingredients. We do not separately store or log the photo, and we do not keep a log of this specific request beyond what Section 9, Data Retention, describes. This does not affect any copy of the photo that may remain in your device's own photo gallery outside the Service.
AI recipe requests. If you request AI recipes, we send your fresh ingredients, relevant Preferences, and session choices such as mood and serving size to Google Gemini to generate suggestions. We keep a short record of each request as Server Data: your user ID, a summary of the ingredients submitted, the number of recipes generated, and the date of the request. We do not log the full recipe text.
Purchases. Your Pro Entitlement, and product and purchase or restore identifiers we receive from a Store, are Server Data. We do not receive your payment card details, which are processed by the Store.
Device and technical data. Basic device type, operating system, app version, and diagnostics needed to operate and secure the Service are Server Data.
Notifications. Your local reminder schedule and notification permission status are On-Device Data.
Daily Fact. The Daily Fact does not involve any data collection, as described in Section 10, Daily Facts, of the Terms of Use.
Website forms. If you use a form on our website, such as a waitlist or contact form, see Section 13, Website and Forms. When you visit our website, we may also automatically receive basic technical information, such as your IP address and browser type, as part of standard web server operation.
We do not use advertising SDKs, third party analytics, or crash reporting tools.
4. HOW WE USE DATA AND LEGAL BASES
We process Personal Data for the following purposes.
To provide the Service (contract, Art. 6(1)(b) GDPR): match meals to your ingredients and Preferences other than Allergy Data, maintain your Account, Preferences, favorites, and Pro Entitlement, and administer your Account, including password reset and notices about changes to these documents.
To notify you when the Service becomes available (steps you requested prior to entering into a contract, Art. 6(1)(b) GDPR): if you join our waitlist, send you a one-time notification when WhatToCook becomes available.
To respond to inquiries (contract, Art. 6(1)(b), where you have an Account, or legitimate interests, Art. 6(1)(f), otherwise): respond to support requests and inquiries submitted through our website.
For security, abuse prevention, and service integrity (legitimate interests, Art. 6(1)(f)): authenticate users, prevent fraud, enforce rate limits, protect the Service as described in Section 12, Acceptable Use, of the Terms of Use, send security notices, and operate, maintain, and secure our website using basic technical information such as your IP address and browser type.
For legal obligations (Art. 6(1)(c)): keep records required by applicable tax, accounting, or consumer law, and respond to lawful requests by authorities.
Where we rely on legitimate interests, we balance those interests against your rights and expectations as a user of a consumer cooking app.
Allergy Data has its own legal basis, described in Section 5, Allergy Data. AI features, including photo ingredient recognition, have their own legal basis and disclosures, described in Section 6, AI Features and Google Gemini. Website forms are described in Section 13, Website and Forms.
5. ALLERGY DATA
Allergy Data can reveal information about your health, so we treat it as a special category of personal data under Art. 9 GDPR, even though you provide it for cooking purposes, not a medical one.
We process Allergy Data only with your explicit consent (Art. 9(2)(a) GDPR), in addition to the basis described in Section 4, How We Use Data and Legal Bases. When you set your allergies, we ask you to confirm this consent separately from other Preferences, before it takes effect. This consent covers both matching your Allergy Data against our on-device catalog and including it in requests to Google Gemini when you use AI recipe generation, described in Section 6, AI Features and Google Gemini.
Declining or withdrawing this consent does not limit your access to the rest of the Service. You can withdraw at any time by clearing your allergy settings, which removes Allergy Data from your device and stops us from including it in future requests to Google Gemini. Withdrawing consent does not affect processing that already occurred. As described in Section 8, Not Medical or Dietary Advice, of the Terms of Use, this filtering is a convenience feature, not a safety guarantee, whether or not you provide Allergy Data.
6. AI FEATURES AND GOOGLE GEMINI
If you use AI recipe generation or photo ingredient recognition, we send the data described in Section 3, Data We Collect and Where It Is Stored, to Google Gemini through our servers. Google Gemini acts as our Processor for this purpose, under Google's published API terms for this service.
Before your first use of each feature, we disclose that Google Gemini will process your data for that specific purpose and ask you to confirm before continuing. We ask separately for AI recipe generation and for photo ingredient recognition, since you may use one without the other.
On Google's paid API tier, which we use, Google does not use your prompts or responses to improve its own products. Google may retain limited request data transiently for a limited period for safety and abuse prevention, under its own terms.
We do not separately store the content of your AI recipe requests beyond the short record described in Section 3, and we do not separately store your Recognition Photo, as described in that same section.
International transfers involved in using Google Gemini are described in Section 8, International Transfers.
7. WHO RECEIVES YOUR DATA
We do not sell your Personal Data.
We share Personal Data with the following recipients.
Processors, who act on our instructions: Supabase, in the EU, for authentication, database, and edge functions; Google Gemini, for AI features described in Section 6, AI Features and Google Gemini; and Hostinger, for our website and email delivery. See Section 8, International Transfers, for safeguards that apply when a Processor handles data outside the EU/EEA.
Independent Controllers, who process data under their own terms: the Stores, for account sign in where you choose it and for subscription purchases, consistent with Section 17, App Store and Google Play, of the Terms of Use. Their own privacy policies govern how they process your data in that role.
We do not share Personal Data with advertisers, and we do not use third party analytics or attribution services.
We may disclose Personal Data if required by law (Art. 6(1)(c) GDPR), or where necessary to protect the rights, property, or safety of WhatToCook, our users, or others, including in connection with a merger, acquisition, or transfer of the Service (legitimate interests, Art. 6(1)(f)), consistent with the assignment provision in Section 20, General Provisions, of the Terms of Use. If this happens, your data continues to be protected as described in this Privacy Policy, or you will be notified of any material change as described in Section 14, Changes to This Privacy Policy.
8. INTERNATIONAL TRANSFERS
Some of our Processors are located, or may process Personal Data, outside the European Union and the European Economic Area. When that happens, we rely on a valid transfer mechanism recognized under applicable data protection law.
Supabase stores and processes your Personal Data in the European Union. No international transfer occurs for that Processor.
Google Gemini processes Personal Data as described in Section 6, AI Features and Google Gemini. Google's data processing terms for this service incorporate the European Commission's Standard Contractual Clauses as the transfer mechanism for Personal Data processed outside the European Union and the European Economic Area.
Hostinger provides our website hosting and email delivery, as described in Section 7, Who Receives Your Data. Hostinger's data processing terms likewise incorporate the European Commission's Standard Contractual Clauses as the transfer mechanism for any Customer Data transferred outside the European Economic Area.
The Stores act as Independent Controllers for account sign in and subscription purchases, as described in Section 7, Who Receives Your Data, and in Section 17, App Store and Google Play, of the Terms of Use. Their processing of your Personal Data, including any transfer outside the European Union and the European Economic Area, is governed by their own privacy policies and is not within our control.
We, as the controller, are established in Ukraine, as described in Section 15, Contact. This does not reduce the safeguards described above for any of our Processors.
Where you have questions about a specific transfer safeguard, you can contact us as described in Section 15, Contact.
9. DATA RETENTION
We keep Personal Data only for as long as it is needed for the purposes described in Section 4, How We Use Data and Legal Bases, or as required by law.
Account data, including your email address and authentication details, is retained for as long as your account is active. If you delete your account as described in Section 6, Account Deletion, of the Terms of Use, we delete this data, except where we are required to retain certain records to comply with a legal obligation, respond to a legal claim, or enforce our agreements. Data may remain in backups for a short additional period after deletion before it is fully removed from our systems.
Your Preferences, including Allergy Data, are stored on your device and remain there until you change them, delete them, or uninstall the App. We do not hold a separate copy of this data on our servers.
Photos you submit for ingredient recognition are not stored by us. As described in Section 3, Data We Collect and Where It Is Stored, and Section 6, AI Features and Google Gemini, they are processed transiently and are not retained after the recognition result is returned to you.
Records of your AI recipe requests, as described in Section 3, Data We Collect and Where It Is Stored, are kept for as long as your account remains active. We delete them when you delete your account, as described in Section 6, Account Deletion, of the Terms of Use. We do not currently apply a separate automatic deletion schedule to these records.
Information submitted through forms on our website, as described in Section 3, Data We Collect and Where It Is Stored, is retained only for as long as needed to respond to your inquiry or, where you asked to join our waitlist, until you ask us to remove you or the purpose for which you provided it has been fulfilled.
Where you have questions about how long a specific category of data is kept, you can contact us as described in Section 15, Contact.
10. DATA SECURITY
We use a combination of technical and organizational measures designed to protect your Personal Data against unauthorized access, alteration, disclosure, or loss.
Supabase, which provides authentication, database, and edge function infrastructure for the Service, encrypts data at rest using the AES-256 standard and encrypts data in transit using TLS. Sensitive items such as access tokens receive an additional layer of encryption before being stored. Supabase holds SOC 2 Type 2 certification, an independent assessment of its security practices.
Google Gemini, which we use for the AI features described in Section 6, AI Features and Google Gemini, is provided by Google, which publishes information about the security certifications and practices applicable to its services.
Our Processors, including Hostinger, are contractually bound to apply appropriate technical and organizational measures to protect the data they process on our behalf.
Our architecture is also designed to limit what there is to protect in the first place. Your Preferences, including Allergy Data, are stored on your device rather than on our servers, as described in Section 3, Data We Collect and Where It Is Stored, and Section 9, Data Retention. Because this data is stored on your device, its protection also depends in part on the security of your device and operating system, including whether you use a passcode or other device-level protections. Photos you submit for ingredient recognition are processed transiently and are never stored by us, as described in Section 3 and Section 6. We do not use third-party advertising or analytics services, as described in Section 7, Who Receives Your Data, which reduces the number of parties your data passes through.
Access to Personal Data within our own systems is limited to what is necessary to operate the Service.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your Personal Data, we will notify you and the relevant supervisory authority as required by applicable law.
If you believe your account has been compromised, or you have a security concern, please contact us as described in Section 15, Contact.
11. YOUR PRIVACY RIGHTS
Depending on where you live, you have certain rights over your Personal Data. If you are located in Ukraine, these rights arise under Ukrainian law, because our controller is established there. If you are located in the European Union or the European Economic Area, these rights arise under the GDPR. If you are located elsewhere, we extend the same rights to you as a matter of policy.
You have the right to access the Personal Data we hold about you, and to receive a copy of it. You have the right to ask us to correct inaccurate Personal Data. You have the right to ask us to delete Personal Data we hold about you, including the data described in Section 9, Data Retention. Where your request concerns your account, this is exercised as described in Section 6, Account Deletion, of the Terms of Use. You have the right to ask us to restrict how we use your Personal Data in certain circumstances. You have the right to receive certain Personal Data you provided to us in a portable format, where we process it based on your consent or to perform our agreement with you. This right applies to your account data, since your Preferences, including Allergy Data, are stored on your device and are not held by us, as described in Section 3, Data We Collect and Where It Is Stored. You have the right to object to our use of your Personal Data where we rely on legitimate interests, as described in Section 4, How We Use Data and Legal Bases, and, where we ever use your Personal Data for direct marketing, you have an unconditional right to object to that use at any time. Where our use of your data relies on your consent, including Allergy Data and the AI consent screens described in Section 5 and Section 6, you have the right to withdraw that consent at any time, using the mechanisms described in those sections.
We do not make any decision about you based solely on automated processing that produces legal effects or similarly significant effects. The recipes and suggestions generated through the AI features described in Section 6 are informational only, as described in Section 8, Not Medical or Dietary Advice, of the Terms of Use, and do not carry this kind of consequence.
To exercise any of these rights, contact us as described in Section 15, Contact. To protect your data, we may ask you to verify your identity before we act on your request. We will respond within one month of receiving your request, or within a longer period where the request is complex, in which case we will tell you why.
You also have the right to lodge a complaint with a data protection authority. Because our controller is established in Ukraine, the competent authority is the Ukrainian Parliament Commissioner for Human Rights, who oversees personal data protection in Ukraine. If you are located in the European Union or the European Economic Area, you may instead, or in addition, lodge a complaint with your own local data protection authority. If you are located elsewhere, you can still contact us with any concern about how we handle your Personal Data, and we will address it in accordance with applicable law.
12. CHILDREN
The Service is not intended for anyone under thirteen years of age. By using the Service, you represent that you meet this requirement, consistent with Section 4, Eligibility, of the Terms of Use. We do not knowingly collect Personal Data from anyone under thirteen.
Your Preferences, including Allergy Data, are stored on your device and are not sent to us, as described in Section 3, Data We Collect and Where It Is Stored, and Section 10, Data Security. This applies regardless of the age of the person using the Service.
Where our processing relies on your consent, as described in Section 5, Allergy Data, and Section 6, AI Features and Google Gemini, that consent is not valid if the law of your country sets a higher age for valid consent to this kind of processing, which can be as high as sixteen in some European Union member states. If we learn that we have relied on consent that was not valid for this reason, we will delete the data collected on that basis.
If you believe a child under thirteen has provided us with Personal Data, please contact us as described in Section 15, Contact.
13. WEBSITE AND FORMS
If you visit our website or submit a form on it, such as to contact us or join our waitlist, we collect the information described in Section 3, Data We Collect and Where It Is Stored.
We use this information as described in Section 4, How We Use Data and Legal Bases, and we keep it as described in Section 9, Data Retention. If you join our waitlist, we send you a single notification when the Service becomes available, and we do not send recurring marketing messages. You can ask us to remove you from the waitlist at any time, as described in Section 15, Contact.
Our website does not use analytics or marketing cookies. It may use cookies or similar technologies that are strictly necessary for it to function, including session cookies set by our hosting provider, Hostinger, as part of standard infrastructure operation. Our website also connects to Google Fonts to display certain fonts, through which Google may process your IP address and request information under its own privacy policy. Consistent with Section 7, Who Receives Your Data, we do not use cookies or similar technologies for advertising or third-party analytics.
14. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. A change is material for purposes of this Privacy Policy if it involves a new category of Personal Data, a new purpose for using it, a new recipient, a change in the legal basis for processing it, a new international transfer of your Personal Data or a change in the safeguard used for one, as described in Section 8, International Transfers, or a significant increase in how long we retain your Personal Data or a reduction in your rights under this Privacy Policy. If we make a material change, we will notify you at least thirty days before it takes effect, consistent with Section 21, Changes to These Terms, of the Terms of Use, by posting a notice in the App or sending you a notice through the Service. Non material changes may take effect without advance notice.
Your continued use of the Service after a change takes effect means you accept the updated Privacy Policy, except where our processing relies on your consent, such as Allergy Data described in Section 5, Allergy Data, or the AI features described in Section 6, AI Features and Google Gemini. Where a material change expands or changes processing that relies on your consent, we will ask for that consent again through the mechanisms described in those sections, rather than relying on your continued use of the Service.
The date at the top of this Privacy Policy shows when it was last updated.
15. CONTACT
Yuliia Mykytiuk, a Ukrainian sole proprietor (fizychna osoba-pidpryiemets, FOP), taxpayer registration number 3598708400, is the data controller responsible for your Personal Data under this Privacy Policy, and publishes WhatToCook, consistent with Section 22, Contact, of the Terms of Use, at vul. Oleksandra Kushniruka 15/1, Khmelnytskyi, 29009, Ukraine.
If you have questions about this Privacy Policy, or want to exercise any of the rights described in Section 11, Your Privacy Rights, you can contact us at support@what-to-cook-app.com.
For how to lodge a complaint with a supervisory authority, see Section 11, Your Privacy Rights.